Bricked Pam

[Stevebe]

hi all i have acidently loaded the wrong firmware to a Middle face PAM AM2T-15K866-AB with a face lift firmware now the module wont respone to anything. tried UCDS force mode but no. is there any way i have recover this unit

[paxtonix]

Do you have Ori UCDS ?Also I've noticed issues when I tried force programing on ori UCDS after update to ver 2,7,003 , before on 2,6 OS , flashing (in my case IPC module ) took max of 10 min. After update I was waiting like forever...

I've bring IPC back with IPCupdate and STN- all went well. Might be there is some BUG with force programing under new version

you have ori or clone ?

[Stevebe]

Do you have Ori UCDS ?Also I've noticed issues when I tried force programing on ori UCDS after update to ver 2,7,003 , before on 2,6 OS , flashing (in my case IPC module ) took max of 10 min. After update I was waiting like forever...

I've bring IPC back with IPCupdate and STN- all went well. Might be there is some BUG with force programing under new version

you have ori or clone ?

Ipc update don’t support PAM , I did try early version of UCDS but got same problem I think loading the wrong firmware has really bricked it I did wonder if there was a direct port to load the firmware back, like JTAG or SW.
It was a stupid mistake on my part I seem to be making a habit of it.. LOL.
Before update

CA514DFE-E12A-4202-BA78-6C2B1B209DFB.jpeg

After update

02225058-89F1-401F-A7E3-CC97901E1BC0.jpeg

[Artist]

Have you tried the possibility of programming dead modules?
If you must enter both hardware and part number "F113"
Sometimes you need to "sleep" other modules or click "Tester" mode.
I updated Pam recently and there was never a problem. But a mistake in UCDS is not excluded either.
I do not believe it cannot be restored. It's just a deleted part of the calibration.

[DGAlexandru]

Remove it from the car, put it on a test bench and create a CAN network with it and OBD port in which you attach only an ELM32 / UCDS adapter configured in sniffing mode. Make sure that between the CAN lines you have 120 ohm (value for MS-CAN).While you are sniffing for any CAN ID, disconnect the power supply of PAM and put it back, do it several times. If you see any activity, then the bootloader is still there. Now go again in UCDS and try the update for dead module, start it without any power supply for PAM and only power it after UCDS tells you to do it so - after you press OK in that window.

[Stevebe]

Have you tried the possibility of programming dead modules?
If you must enter both hardware and part number "F113"
Sometimes you need to "sleep" other modules or click "Tester" mode.
I updated Pam recently and there was never a problem. But a mistake in UCDS is not excluded either.
I do not believe it cannot be restored. It's just a deleted part of the calibration.

Yes tried a few times just says can’t retrieve hardware details

[Stevebe]

Remove it from the car, put it on a test bench and create a CAN network with it and OBD port in which you attach only an ELM32 / UCDS adapter configured in sniffing mode. Make sure that between the CAN lines you have 120 ohm (value for MS-CAN).While you are sniffing for any CAN ID, disconnect the power supply of PAM and put it back, do it several times. If you see any activity, then the bootloader is still there. Now go again in UCDS and try the update for dead module, start it without any power supply for PAM and only power it after UCDS tells you to do it so - after you press OK in that window.

Tried this also there’s nothing coming from module from sniffer I use can hacker 3b

[Go4IT]

I did wonder if there was a direct port to load the firmware back, like JTAG or SW.

This was also my question here viewtopic.php?f=29&t=70
but could not make it anyway now. Maybe need investigate further as the chip used is really a broadly used one MC9S12DG128CFUE in automotive modules...

Oh, btw. if you test it on the bench, you should send IGN message on CAN, as modules may only starts sending when they detect these. Just in case you don't know, it is ID 048 send every 60 ms with 00 00 2A 04 26 00 10 2C

[Stevebe]

I did wonder if there was a direct port to load the firmware back, like JTAG or SW.

This was also my question here viewtopic.php?f=29&t=70
but could not make it anyway now. Maybe need investigate further as the chip used is really a broadly used one MC9S12DG128CFUE in automotive modules...

Oh, btw. if you test it on the bench, you should send IGN message on CAN, as modules may only starts sending when they detect these. Just in case you don't know, it is ID 048 send every 60 ms with 00 00 2A 04 26 00 10 2C

sent ignit can but its dead i see it has a BDM port io a BDM reader but no drivers for win10 will have set up a win7 box

[Ursadon]

Maybe PAM stuck at bootloader. This is easy to verify if you have ELS27 cable.

1. Download Br@y++ terminal https://sites.google.com/site/terminalbpp/
2. connect to your ELS27.
3. send AT commands: AT ST 53 (to change baud and can mode) and AT SH 736 (to change dst address)
4. Press "Set macros button" and put this to first macro: 1002#013#010%DLY0030
this macro send 10 02 (startDiagnostincSession for program download) with CR and LF every 30ms
5. Set delay to 10 or 30 ms
6. Check chekbox right after macro definition to start autorepeat this command

screenshot.png

7. Examine log - if your see "STOPPED", then module is really dead. If you see some hex output - then you can recover it
8. Also: try to power-off and power-on device several times, while terminal sends a macro